-
Couldn't load subscription status.
- Fork 563
Open
Description
from __future__ import print_function
from triton import *
import sys
function = {
0x3ADFC8: b"\xFE\x07\xC1\xDA", # PACIB X30, SP
0x3ADFCC: b"\xFF\x43\x01\xD1", # SUB SP, SP, #0x50
0x3ADFD0: b"\xFD\x7B\x02\xA9", # STP X29, X30, [SP,#0x40+var_20]
0x3ADFD4: b"\xF5\x1B\x00\xF9", # STR X21, [SP,#0x40+var_10]
0x3ADFD8: b"\xF4\x4F\x04\xA9", # STP X20, X19, [SP,#0x40+var_s0]
0x3ADFDC: b"\xFD\x83\x00\x91", # ADD X29, SP, #0x20
0x3ADFE0: b"\xFF\x7F\x01\xA9", # STP XZR, XZR, [SP,#0x40+holder.section]
0x3ADFE4: b"\xFF\x07\x00\xF9", # STR XZR, [SP,#0x40+holder]
0x3ADFE8: b"\x00\x01\x00\xB5", # CBNZ X0, loc_3AE008
0x3ADFEC: b"\xF4\x03\x1F\x2A", # MOV W20, WZR
0x3ADFF0: b"\xE0\x03\x14\x2A", # MOV W0, W20
0x3ADFF4: b"\xF5\x1B\x40\xF9", # LDR X21, [SP,#0x40+var_10]
0x3ADFF8: b"\xF4\x4F\x44\xA9", # LDP X20, X19, [SP,#0x40+var_s0]
0x3ADFFC: b"\xFD\x7B\x42\xA9", # LDP X29, X30, [SP,#0x40+var_20]
0x3AE000: b"\xFF\x43\x01\x91", # ADD SP, SP, #0x50
0x3AE004: b"\xFF\x0F\x5F\xD6", # RETAB
0x3AE008: b"\x08\x00\x40\xF9", # LDR X8, [X0]
0x3AE00C: b"\x08\x1D\x40\xB9", # LDR W8, [X8,#0x1C]
}
if __name__ == '__main__':
# Triton context
ctx = TritonContext()
# Set the architecture
ctx.setArchitecture(ARCH.AARCH64)
# Symbolic optimization
ctx.setMode(MODE.ALIGNED_MEMORY, True)
# Define the Python syntax
ctx.setAstRepresentationMode(AST_REPRESENTATION.PYTHON)
# Define entry point
pc = 0x3ADFC8
# Let's emulate the function
for pc in function:
# Build an instruction
inst = Instruction()
# Setup opcode
inst.setOpcode(function[pc])
# Setup Address
inst.setAddress(pc)
# Process the instruction
ctx.processing(inst)
#print(inst)
# Spread the instruction address and its disassembly into its symbolic
# expressions. Used to refer an instruction to its expressions. Will
# be useful to understand the slicing part.
for se in inst.getSymbolicExpressions():
se.setComment(str(inst))
reg_obj = ctx.getRegister('X8')
# Let's slice (backward) the rcx expression at 0x4005ae
if pc == 0x3AE00C:
x8Expr = ctx.getSymbolicRegister(reg_obj)
slicing = ctx.sliceExpressions(x8Expr)
# Sort the slicing and display all expressions with their comments
for k, v in sorted(slicing.items()):
# Here we display the comment to understand the correspondence
# between an expression and its referenced instruction.
print('[slicing]', v.getComment())
break
sys.exit(0)
After execution, the following result is output:
[slicing] 0x3ae00c: ldr w8, [x8, #0x1c]
The correct result should be:
[slicing] 0x3ae008: ldr x8, [x0]
[slicing] 0x3ae00c: ldr w8, [x8, #0x1c]
Question: Is the issue with my code, or does Triton have bugs in analyzing ARM64 programs?
Metadata
Metadata
Assignees
Labels
No labels